Schedule search includes result from non-default index

[daniel_splunk]

From the document, if index=myindex was not mentioned, Splunk search will only use default indexes. However, I found that the behaviour is not true anymore. When I run a search, result return from non default index as well.

What is the possible cause?

[daniel_splunk]

You can check whether srchFilter is set in your role.

For example,

authorize.conf 
[default] 
srchFilter = NOT index=*_archive 

If you have set srchFilter to some value, it will get added to every search for this role.

As your srchFilter exist, it includes an “index=“ line and Splunk is not going to look at the srchIndexesDefault parameter.